Windows Kernel 0-day Actively Exploited

Google’s threat analysis group has observed active attacks for Windows kernel win32k.sys vulnerability and has therefore disclosed this previously unknown vulnerability. It’s a local privilege escalation issue which implies that an attacker would need valid local credentials to trigger the issue. If exploited an attacker with low privilege could obtain higher privilege like that of an administrator. The only technical details known at this point is that the issue can be triggered via the win32k.sys system call NtSetWindowLongPtr() for the index GWLP_ID on a window handle with GWL_STYLE set to WS_CHILD.

There is currently no patch or acknowledgement from Microsoft about the issue. Please stay tuned for updates. For reference, see the Google disclosure blog post.